In all other cases, the three Identity Preferences were all I needed. On one occasion I had a corrupt Key Chain and hand to actually delete it and start over. Second, I've gotten CAC to work with NMCI and a few other sites with all versions of MAC OS X from 10.5.3 thru 10.6.2 by using the NMCI procedure of assigning an Identity Preference for their three URL's. I've been working this issue through Enterprise Services for over two years and have basically been told that there are not enough complaints for them to do anything about this. Please go to APPLE FEEDBACK and tell them you want CAC to work automatically without using the work around with Identity Preferences.

The attached file shows my current results.įIRST!!! Apple knowingly created the problem with CAC on MAC (See HT 1679). Under Tiger, there is some validation chain error, even though I've offloaded and reloaded the DoD roots and verified the appropriate versions of supporting certs. My Leopard keychain shows the certs loaded and properly authenticated. I could not access AF Portal or TriCare in Safari under Leopard, or anything under Firefox in Leopard (can't point to CAC device driver.) I could authenticate to the Navy site, however. I could access (with some unexplained cert chain errors) the Air Force Portal, TriCare Online, and an internal Navy site under Tiger and WinXP with Safari, Firefox 3, and Internet Explorer 7 (WinXP only). I had mixed results with web access to various government sites, but no problem digitally signing and encrypting emails in Entourage 2004 and Outlook 2007. I also ran WinXP in Parallels 4 I'm using SCR331 and SCR3310 CAC readers, and ActivClient 6.1 for Windows. I have a MacBook Pro running 10.5.6 (and an older MacBook that also used an external drive to devolve to 10.4.11).

Scr3310 cac reader mac